High-assurance cryptography has long relied on
constant-time programming [1]}
in order to create software which is secure from timing side-channel attacks.
Constant-time programming dictates that
both control flow (e.g., conditional branches) and memory addresses
(e.g., offsets into arrays) are not influenced by secret
information [1]}, [3]}.
These rules ensure that secrets remain safe from an attacker with the ability
to perform cache attacks on either the instruction or data cache, exfiltrate
data via branch predictor state, or even infer secret data from port
contention in the microarchitecture [4]}.
The rules can also easily be extended to consider timing leaks due to
variable-latency instructions (e.g., floating-point, SIMD, or integer division
on many processors) [5]}.
